From f8ae87adbff9eb563e2ea236f76df20231860ef7 Mon Sep 17 00:00:00 2001
From: Sean McArthur <sean@seanmonstar.com>
Date: Tue, 28 Jul 2026 10:59:44 -0400
Subject: [PATCH] fix(uri): enforce max length in PathAndQuery

---
 src/uri/path.rs | 21 ++++++++++++++++++++-
 1 file changed, 20 insertions(+), 1 deletion(-)

diff --git a/src/uri/path.rs b/src/uri/path.rs
index a9836a33..f62a6867 100644
--- a/src/uri/path.rs
+++ b/src/uri/path.rs
@@ -4,7 +4,7 @@ use std::{cmp, fmt, hash, str};
 
 use bytes::Bytes;
 
-use super::{ErrorKind, InvalidUri};
+use super::{ErrorKind, InvalidUri, MAX_LEN};
 use crate::byte_str::ByteStr;
 
 /// Represents the path component of a URI
@@ -475,6 +475,10 @@ const fn scan_path_and_query(bytes: &[u8]) -> Result<Scanned, ErrorKind> {
         return Err(ErrorKind::Empty);
     }
 
+    if bytes.len() > MAX_LEN {
+        return Err(ErrorKind::TooLong);
+    }
+
     if bytes.len() == 1 && bytes[0] == b'*' {
         return Ok(Scanned {
             query,
@@ -676,6 +680,21 @@ mod tests {
         PathAndQuery::try_from(&[b'/', b'a', b'?', 0x7F][..]).expect_err("reject DEL");
     }
 
+    #[test]
+    fn rejects_too_long_path_and_query() {
+        let path = format!("/{}?query", "a".repeat(MAX_LEN));
+        let err = PathAndQuery::try_from(path).expect_err("reject overly long path and query");
+        assert_eq!(err.0, ErrorKind::TooLong);
+    }
+
+    #[test]
+    fn accepts_max_length_path_and_query() {
+        let path = format!("/{}?", "a".repeat(MAX_LEN - 2));
+        let path_and_query = PathAndQuery::try_from(path).expect("accept maximum length");
+        assert_eq!(path_and_query.as_str().len(), MAX_LEN);
+        assert_eq!(path_and_query.query(), Some(""));
+    }
+
     #[test]
     fn json_is_fine() {
         assert_eq!(